Destroyed Partition/File Table


I was trying to perform a new install, so sensibly made a back-up of my data to my external drive. Unsensibly, I didn’t unplug the disc before starting the install and the install trashed the partition table/FAT on the external drive.

I’ve used disktree and can “see” that the disk has lots on it, but I cannot access it.

Does anyone have any suggestions as to what I do next? Suicide is an option.

You mean you destroyed the original data by an install, the backup by the same install?

I don’t think I’ve destroyed the back-up data, but I have damaged/deleted the file allocation table, meaning that I can’t mount the disk using Knoppix, openSuse etc.

I can get the files using disktree, but that’s not great as all the names/datestamps are lost, just the extension remaining.

And what did the install make out of it?

First the install must have offered you what it would do to it (and when there is any dangerous thing in the offering it is in read), so you must have seen it.

Second, when you continued, it did what it suggested. That means that it made something new one the disk (partitioning and maybe formatting) and not halfway, but complete. That means that the partitioning of it must be visible with:

fdisk -l

We are curious.

Yes to all the above - I just didn’t register that I was doing anything to the external disk. Here’s the output from fdisk:

WARNING: GPT (GUID Partition Table) detected on '/dev/sdc'! The util fdisk doesn't support GPT. Use GNU Parted.

Disk /dev/sdc: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00061d17

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1               1       60801   488384001   8e  Linux LVM

Thanks for the help.

As you see it made a LVM partition out of it.

What was it before? Is it true that there was only one partition? And what sort of fs was on it?
When it was a Linux type (like ext2/3/4 or Reiser) we could try to change it to type 83. If it was some MS type we could change to 6 (vfat) or 7 (ntfs). So it is important to know.

You can change the type with fdisk. Let us suppose the device is /dev/sdf (be sure beefore you break another disk).

# fdisk /dev/sdf

command (m for help): t
Selected partition 1
Hex code (type L to list codes): X

Command (m for help): w


As you see what you have to type is in red.
The t command: change a partition’s system id.
Because there is only one partition it is chosen automaticaly.
For X choose 6 or 7 or 83.
When you do the w it writes the partition. You could always do a q to quit without (more) harm done.

After you changed the partition table in this way, try again if it can be mounted. I am not sure if it helps because I do not know exactly what is done to the disk. But this is rather save to do. In the same way you can change back to 8e.

Thanks - but when I try the “t” command, I get the message:

“No partition is defined yet!”

What should I do now?

Hm, suprise. I played it here on an USB sticky (except for a q instead of a w :wink: at the end).

You can play a bit with fdisk. As said, as long as you do no w nothing is done to the partition table. And when you do a w, only the partition table is rewriten, nothing else.
The m for a list of commands is interresting.

Check with p if it still sees the one partition. When not, create one (with the correct type) and use the exact start/end 1 and 60801 as in your listing. When there is one you could even delete it and create anew.

I repeat (important for your nerves :slight_smile: ) it only writes the partition table and you can try and test there endlessly.

I must excuse myself, but I will be back tomorrow (do not know what TZ you are in, but here it is 23:10) to answer further reports/questions from you. Wishing you sucess.

Following this thread I noticed in the output off fdisk -l:

WARNING: GPT (GUID Partition Table) detected on ‘/dev/sdc’! The util fdisk doesn’t support GPT. Use GNU Parted.
Is this perhaps why “no partition is defined yet”?

I’ve tried what you have suggested, but no joy. I am in UK, so am about an hour behind you.

Am going to bed as well! Thanks for your help - I’ll try again in the morning.

Don’t know - this is all very new - and scary!!! - to me. ANy advice you could give would be appreciated.

Ouch, I feel for you. The other posters here have given some good advice, but I’ll pop in with my two cents’ worth.

First, I’m sure that the reason Knurph asked what he did was because you say the backup was destroyed. What about the original disk (i.e., the one you backed up)? I realize that this is kind of obvious, and surely you’ve thought of that, but hey; when you’re desperate, you grab at any possibility. At any rate: if the original is still intact, or even repairable, proceed from there.

Or I’m assuming that the install “straddled” the two disks; right? For example, it put “/home” on the USB drive, and “/” on the internal drive? (Or vice-versa.)

The reason I ask is because it’s possible that the original “/home” partition is still intact somewhere on the internal drive. Use the PartedMagic bootable CD to see if he can find anything. Unplug the USB drive and leave it out of the equation for now.

If you’re doing a reinstall, you don’t necessarily care about the root partition, just “/home” (unless you had a lot of stuff in, say, “/var,” but that’s unusual).

Assuming that both drives are well and truly trashed, here’s my opinion: you’re probably hosed. I hate to tell you that, but it’ll save you time in the long run. If you have ext3 partitions, it’s very difficult to do a recover-after-delete from them. You might could possibly recover individual files, as you’ve noted, but there’s no guarantee that they’re not corrupted.

As an alternative, you could take the drive to a professional recovery shop, but that’s when you have to make the hard decision about whether it’s worth what they’ll charge (they’re NOT cheap). That’s why I say that, at the end of the day, you may just have to start over from scratch.

Nothing would please me more than for someone to poke in here and tell me I’ve got rocks in my head and there’s an easy way for you to recover what you’ve got, so wait for a second opinion. But that’s mine.

I supportthe other observations made above.

The big problem her is that we ddo not even know:
a) how both disks were partioned and formatted before yoy started;
b) what the install sugested and executed during install.

This it is very very vague if we can revert anything that was done. My proposal do try something with fdisk (some mention gparted, it works similar as fdisk, but I love fdisk for its simplicity, you know what you are doing) was because that is what I would have tried. But maybe, because of the fact that fdisk thinks it is GPT, gparted is better in this case. But again, when we do not even know what it was before … What to do???

The next remark is not especialy to you, but in ggneral:
People should document much, much more on what they have, have done, configured, etc. By a disk? Write down: make, type, serial, what partitioning, what formatting/fs-type, etc.

In the mean time I am afraid that if you do not have any other backup (did you backup to that disk on a regular base or just for the install, and where did you regularly backup then?), a forensic shop will be the only possibility.

Thanks for all the help and suggestions. Of course, the fact that I didn’t know that I needed all the hard disc info didn’t help after the event (my problem:(, not yours - thanks for the info now).

If I go on the basis that I’m unlikely to make the same mistake twice, I can confidently state that I am rapidly running out of new areas to completely **** up my system.

I’m sure this wouldn’t have happened under Windows, but neither would I have learned as much about PCs, OSs and hardware. On balance, I’m glad I made the switch - and the mistakes along the way.

I’ll hopefully be able to reconstruct sufficient from my older backup (another USB disk) to let me get by.

Thanks again for the attempts to assist.:slight_smile:

You are welcome. Be assured we regret your loss of data allmost as much as you do. We know wat we would feel in the same case.

Feel free to ask new questions (especialy befor you try an adventurous move).

And do not be to sure about this not happening on an MS system >:)

I’ve trashed sufficient Windows systems to know that it can happen - I suppose I mmeant that, by using Linux, I’ve gained a little knowledge…which can be a dangerous thing…

Thanks again.

Amen, Bro. My assistant received a brand new Dell laptop for a new hire earlier this week. When he went to prep it up, he connected the network and let it do updates overnight … and when he came in the next morning, he had wallpaper, but no icons or taskbar. Something in the update process had hosed this brand new Windows XP installation. After fooling with it for a few hours, he finally just nuked it and reinstalled (fortunately, Dell did include a rebuild DVD).

We suspect that the update might have had a corrupted download, but of course, there’s no way to prove it.

So yes, fun things happen in the Windoze world as well. :slight_smile:

I like your attitude. Once you get used to Linux, you’ll never go back. (Seriously. The only time I use Windows now is for some audio editing software, and for tax preparation.)

When you reinstall, be very, very, very careful what you approve in the Partitioning part of the process. If need be, write down what you see in the “suggested partitioning” and post here before you press the Big Red “GO” Button[tm]. :slight_smile:

Just for the record, Suse’s partitioner is about the best I’ve run across amongst Linux distributions, but even it can make mistakes sometimes. I just hate that it happened to you. I realize that you’re the one who left the USB drive plugged in, and the partitioner thought that it had a nice, juicy big-and-fat drive to play with, but still; that’s why I suggest that, if you have ANY questions, you post here before proceeding past the Partioning part of the install.